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Using XKS to find and search for logos embedded in documents 



XKEYSCORE will parse out the logos inside of documents like MS Office and Outlook 
emails. If you're traffic hasn't aged of, load it into a session viewer and hopefully you'll 
see w'here there's a logo or attachment. See here, this spreadsheet has a logo in it. 
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(TS//SI//REL) XKEYSCORE takes that logo and calls it an attachment. Click on 
Attachments to see all of the attachments. 
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(U//FOUG)In the Attachments window, look for ones with jpg or png. 
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(U//FOUO) Notice the hash of the jpg 
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(TS//SI//REL) Now you take the 32-character hash (e.g. 

6a476b2cedccb34946f5e9c76l03d0f2 ) and paste that into a Document Metadata search 
under the File/Embedded Image Hash field: 



Search: Document Metadata 



Query Name: 
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Justification: 



File/Embedded Image 
Hash r fullte wt] : 
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(TS//SI//REL) Before you hit submit, you MUST think if the logo could be used by 5- 
EYES protected entities. It should go without saying, but take extra precaution if you 
think it could bring back 5 -EYES traffic. What would you do to ensure it's foreign? 
Maybe AND that with a country? 
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(TS//SI//REL) Then hit submit and check your results. Your results MAY show you 
actual files that were sent to and from people you've never HEARD OF (how cool is 
that?) 



Happy hunting.. 
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